4 ms·
I doubt this is them trying to block YouTube. The certificate has SAN entries for things like google-analytics.com, android.com, *.cloud.google.com, goo.gl, g.
by RKearney 12y ago
I doubt this is them trying to block YouTube.
The certificate has SAN entries for things like google-analytics.com, android.com, *.cloud.google.com, goo.gl, g.co, urchin.com, and a plethora more[0].
If they wanted to just block YouTube, there are ways to do that without forging certificates. For example, modern browsers will send the domain name in plain-text even for HTTPS connections for SNI to function. They could easily block based on that.
[0] http://imgur.com/a/C8Tf4 http://imgur.com/a/C8Tf4
- userbinator 12y agoThey just cloned the list of SANs in the standard Google certificate, which YouTube also uses. Captive WiFi portal (or some sort of traffic-shaping) is likely the right answer, as the other poster above points out. Given that the issuer is an internal IP I'm pretty sure they are just proxying HTTP(S) requests, grabbing the remote certificate, duplicating the subject and signing it, allowing them to on-the-fly MITM any HTTPS traffic. Trying this with a different HTTPS site will easily show this, I don't think they're specifically targeting Google directly.